mistral - Debian Package Tracker

general

source: mistral (main)
version: 22.0.0-1
maintainer: Debian OpenStack (DMD)
uploaders: Thomas Goirand [DMD] – Michal Arbet [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 11.0.0-2
oldstable: 15.0.0-1
stable: 20.0.0-2
testing: 22.0.0-1
unstable: 22.0.0-1

versioned links

11.0.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
15.0.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.0.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.0.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

mistral-api
mistral-common
mistral-engine
mistral-event-engine
mistral-executor
python3-mistral

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-41283: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
TEMP-1138849-FDBA9E:

Created: 2026-06-03 Last update: 2026-06-05 07:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-41283: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
TEMP-1138849-FDBA9E:

Created: 2026-06-03 Last update: 2026-06-05 07:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-41283: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
TEMP-1138849-FDBA9E:

Created: 2026-06-03 Last update: 2026-06-05 07:00

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-41283: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
TEMP-1138849-FDBA9E:

Created: 2026-06-03 Last update: 2026-06-05 07:00

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-41283: OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. There are endpoints that allow code execution, which can lead to exfiltration of service credentials.
TEMP-1138849-FDBA9E:

Created: 2026-06-03 Last update: 2026-06-05 07:00

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-06-04 Last update: 2026-06-07 15:47

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 22.0.0-3, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 35c88147e6b78a9a9efee7ab114da21e9940770b
Author: Thomas Goirand <zigo@debian.org>
Date:   Thu Jun 4 23:57:25 2026 +0200

      * OSSN-0098: Mistral workflow execution context exposes Keystone auth token.
        Applied upstream patch: "Strip sensitive info from workflow execution
        context" (Closes: #1138849).

commit 0cd57c9021442604456bc10bece13d28ef2dab80
Author: Thomas Goirand <zigo@debian.org>
Date:   Mon May 25 17:07:47 2026 +0200

      * CVE-2026-41283: Mistral policy enforcement bypass allows unauthorized
        public resource creation and arbitrary code execution. Applied upstream
        patches:
        - Restrict publicize policies to admin only
        - Remove unnecessary expect_errors=True from policy tests
        - Add code_sources publicize policy and enforcement
        - Restrict code_sources and dynamic_actions policies to
        - Add dynamic_actions publicize policy and enforcement
        - Add workbooks publicize policy and enforcement
        - Add cron_triggers publicize policy and enforcement
        - Add environments publicize policy and enforcement

Created: 2026-06-04 Last update: 2026-06-04 23:01

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-05-28 Last update: 2026-05-28 16:32

lintian reports 13 warnings normal

Lintian reports 13 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-27 Last update: 2026-03-28 03:30

debian/patches: 1 patch to forward upstream low

Among the 2 debian patches available in version 22.0.0-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2025-10-03 Last update: 2026-04-02 09:33

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-04-01 22:30

news

[rss feed]

[2026-04-07] mistral 22.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-04-01] Accepted mistral 22.0.0-1 (source) into unstable (Thomas Goirand)
[2026-04-01] mistral 22.0.0~rc1-3 MIGRATED to testing (Debian testing watch)
[2026-03-27] Accepted mistral 22.0.0~rc1-3 (source) into unstable (Thomas Goirand)
[2026-03-18] Accepted mistral 22.0.0~rc1-2 (source) into experimental (Thomas Goirand)
[2026-03-12] Accepted mistral 22.0.0~rc1-1 (source all) into experimental (Thomas Goirand)
[2026-02-18] mistral 21.0.0-6 MIGRATED to testing (Debian testing watch)
[2026-02-11] Accepted mistral 21.0.0-6 (source) into unstable (Thomas Goirand)
[2025-11-07] mistral 21.0.0-5 MIGRATED to testing (Debian testing watch)
[2025-11-01] Accepted mistral 21.0.0-5 (source) into unstable (Thomas Goirand)
[2025-10-15] Accepted mistral 21.0.0-4 (source) into unstable (Thomas Goirand)
[2025-10-03] Accepted mistral 21.0.0-2 (source) into unstable (Thomas Goirand)
[2025-10-01] Accepted mistral 21.0.0-1 (source) into unstable (Thomas Goirand)
[2025-10-01] Accepted mistral 21.0.0~rc1-2 (source) into unstable (Thomas Goirand)
[2025-09-16] Accepted mistral 21.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-07-18] mistral 20.0.0-2 MIGRATED to testing (Debian testing watch)
[2025-07-12] Accepted mistral 20.0.0-2 (source) into unstable (Thomas Goirand)
[2025-04-07] mistral 20.0.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-02] Accepted mistral 20.0.0-1 (source) into unstable (Thomas Goirand)
[2025-03-28] Accepted mistral 20.0.0~rc1-2 (source) into unstable (Thomas Goirand)
[2025-03-20] Accepted mistral 20.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2025-01-21] mistral 19.0.0-2 MIGRATED to testing (Debian testing watch)
[2025-01-15] Accepted mistral 19.0.0-2 (source) into unstable (Thomas Goirand)
[2024-10-08] mistral 19.0.0-1 MIGRATED to testing (Debian testing watch)
[2024-10-02] Accepted mistral 19.0.0-1 (source) into unstable (Thomas Goirand)
[2024-09-26] mistral 19.0.0~rc1-2 MIGRATED to testing (Debian testing watch)
[2024-09-20] Accepted mistral 19.0.0~rc1-2 (source) into unstable (Thomas Goirand)
[2024-09-17] Accepted mistral 19.0.0~rc1-1 (source) into experimental (Thomas Goirand)
[2024-04-07] mistral 18.0.1-1 MIGRATED to testing (Debian testing watch)
[2024-04-04] Accepted mistral 18.0.1-1 (source) into unstable (Thomas Goirand)

bugs [bug history graph]

all: 2
RC: 1
I&N: 0
M&W: 0
F&P: 1
patch: 1

links

homepage
lintian (0, 13)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 22.0.0-0ubuntu1
1 bug
patches for 22.0.0-0ubuntu1